Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 95de79441bb96c7a…

MALICIOUS

Office (OLE) / .DOC

374.0 KB Created: 2020-04-01 21:39:42 Authoring application: Microsoft Excel
MD5: 9d3184df9907d86a5973155472fbbf66 SHA-1: 8ae27f350d0acbd1ec241972f1a90497c57a9555 SHA-256: 95de79441bb96c7aa71a2c7e16af3d654158d6e823ae01037f3aabc972d86da1
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059.003 Windows Command Shell

The sample is an encrypted Excel 4.0 macro sheet, indicated by multiple heuristic firings including OLE_XLM_ENCRYPTED_MACROSHEET and OLE_XLM_AUTOOPEN. The presence of encrypted macros strongly suggests an attempt to hide malicious code execution. The document body is heavily corrupted and unreadable, providing no further context on the specific lure or payload. Without readable document content or extracted scripts, the exact nature of the attack remains unclear, but the core mechanism points to macro-based execution.

Heuristics 3

  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • OLE metadata lists many Excel 4.0 macro sheets high OLE_XLM_DOCPROPS_MACROSHEET_INVENTORY
    Workbook contains a BIFF Excel 4.0 macro-sheet marker and its clear OLE DocumentSummaryInformation stream lists many MacroN sheet titles. This is a useful static signal when FILEPASS encryption prevents formula extraction from the workbook stream.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.